RedHook Android RAT Abuses Wireless ADB via Accessibility Service to Gain Shell-Level Device Access — Threadlinqs Intelligence
As of 2026-07-12, RedHook Android RAT Abuses Wireless ADB via Accessibility Service to Gain Shell-Level Device Access is a high-severity malware threat attributed to RedHook Operators (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 29 indicators of compromise.
Threat ID: TL-2026-1248 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: RedHook Operators · China · FINANCIAL
An upgraded variant of the RedHook Android RAT abuses Accessibility Service permissions to silently enable Developer Options and Wireless Debugging, then connects to the on-device ADB daemon over
RedHook is an Android remote access trojan first documented by Cyble Research and Intelligence Labs in July 2025 as a banking trojan targeting Vietnamese users, distributed through phishing sites impersonating the State Bank of Vietnam (sbvhn[.]com), Sacombank, Central Power Corporation, the Traffic Police of Vietnam (CSGT), and the Vietnamese government. The original variant abused Accessibility Services and overlay permissions to harvest keystrokes, capture the screen via the MediaProjection API, and exfiltrate SMS, contacts, and banking credentials through a WebSocket-based RAT supporting 34 server-issued commands. APKs were hosted on an exposed AWS S3 bucket and CloudFront distribution; sequential user IDs in the leaked infrastructure suggested over 500 infected devices. Chinese-language strings in logs and leaked screenshots suggest a Chinese-speaking developer or operator.
In July 2026, Group-IB documented a significantly upgraded RedHook variant that is the first malware observed abusing Android's Wireless ADB (Wireless Debugging) feature to autonomously self-escalate privileges. Using its existing Accessibility Service foothold, the malware programmatically simulates the exact UI interactions a user would perform to enable Developer Options, activate Wireless Debugging, and pair itself as an authorized computer -- all invisibly, behind a full-screen overlay or fake system update dialog. It then launches an embedded ADB client (referenced internally as "libmx.so") that connects to the on-device adbd daemon over the loopback interface and spawns a privileged shell process at uid 2000 (the Android `shell` user). This shell-level access is functionally equivalent to what the legitimate open-source Shizuku framework provides to enthusiasts seeking elevated permissions without rooting; RedHook embeds Shizuku-derived logic to run a persistent privileged server that can grant itself additional runtime permissions, write to `Settings.Secure` (including `WRITE_SECURE_SETTINGS`), execute arbitrary shell commands, silently install/uninstall applications, and capture raw touch input -- all without further user prompts. This escalation path requires no root and no USB/OEM unlocking, working on any Android 11+ device that supports Wireless Debugging, which is the overwhelming majority of the current install base.
The command set has grown to 53 server-issued functions covering device reconnaissance, UI automation (taps, swipes, gestures, drags, long presses), notification bar access, contact/app/SMS harvesting, UI-layout (accessibility node tree) exfiltration, silent APK install/uninstall, text injection and navigation control, screen capture (screenshot and continuous streaming via WebSocket and, once privileged, RTMP), camera activation, device reboot, permission-check and grant primitives, fake system-update overlays, ADB-prompt dismissal automation, and OEM-specific routines tuned for Samsung, Xiaomi, Oppo, Vivo, Huawei, Meizu, and Google devices.
Persistence is achieved through a layered stack: a 1x1-pixel foreground activity that keeps the app foreground-classified even with the screen off; silent background audio playback via a MediaSession to win elevated OS process priority; a held WakeLock to defeat battery-optimization suspension; two mutually-monitoring internal services that relaunch each other via BIND_AUTO_CREATE if either is killed; a five-minute watchdog alarm that re-verifies service health; a BOOT_COMPLETED receiver for post-reboot restoration; and an oom_score_adj value of -1000 that exempts the process from Android's low-memory killer.
Distribution continues via social engineering: operators impersonate government officials or bank support staff over phone calls and messaging apps (Zalo is specifically documented), directing victims to fake Google Play Store replica sites to download a malicious APK. Targeting has expanded from Vietnam to Indonesia and the broader Southeast Asia region. C2 infrastructure for
Weaknesses (CWE)
CWE-250, CWE-269, CWE-451
Target sectors: finance, government administration, banking, consumer mobile
Target regions: vietnam, indonesia, Southeast Asia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 29 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583.006, T1660, T1204.001, T1623, T1547, T1624.001, T1541, T1548, T1548.004, T1564